Security brief: the `open` package is the root cause behind the MCP OAuth PowerShell chain, an MCP PDF server logs that authentication is on while it checks nothing, and vLLM 0.32.0 closes an image-to-Ghostscript path

Executive summary

The level stays elevated: nothing here is exploited, and the window was thin. The one development that changes risk is a root cause finally getting a CVE. Two weeks of MCP client flaws on Windows (the Inspector’s PowerShell injection, OpenCode’s OAuth flow) share a single component, the widely used npm open package, which builds a PowerShell command from a URL without escaping it. That means the exposure is not “two products”; it is every Node tool that opens a URL it received from a server it does not control, and an inventory of your own dependency trees will find more of them than the two named. The other two items are old patterns in new places: an MCP server whose log line says authentication is on while it checks nothing, and an inference server where “decode this image” can end in a different program being executed.

Vulnerabilities

Item	Severity	Fixed in	Exploited	Notes
open npm package, PowerShell injection (CVE-2026-119025)	High 7.7 (v4)	11.0.0	No evidence	Windows and WSL; unreviewed record, versions from description
@sylphx/pdf-reader-mcp, API key never checked (CVE-2026-62264)	High 7.5	3.0.1	No evidence	HTTP mode only; default bind 0.0.0.0
vLLM, forged shared-memory handle to pickle (CVE-2026-115912)	High 7.5	0.32.0	No evidence	Needs SHM multimodal cache and credentials
vLLM, EPS decoded via Ghostscript (CVE-2026-115915)	High 8.1	0.32.0	No evidence	RCE needs an affected Ghostscript build on the host
vLLM, Responses API ignores chat-template trust gate (CVE-2026-115918)	Moderate 6.5	0.32.0	No evidence	Availability only; authenticated caller
GitPython, environment variable expansion in submodule name (GHSA-fx3j-rwgx-fr94)	Moderate 6.5	3.2.0	No evidence	No CVE; needs recursive submodule init on a hostile repository
Royal MCP WordPress plugin, missing object-level check (CVE-2026-111960)	Moderate 4.3	1.5.10 by description	No evidence	Low-privilege user reads non-public posts; unreviewed

MCP and protocol security

The open package: one unescaped URL under two products and a class of clients

OfficialCVSS 7.7Update · 29 Oct

What happened. GitHub indexed CVE-2026-119025 (GHSA-jgwm-4pmq-r4w4) on 29 Oct as an OS command injection in the open package by sindresorhus. The description covers open 7.2.0 before 11.0.0 on Windows and WSL: index.js passes the URL into powershell -EncodedCommand without escaping, and a $(...) subexpression in the URL is evaluated. The advisory’s example route is an OAuth authorization_endpoint supplied by a malicious MCP server, and it links the MCP Inspector advisory GHSA-q978-78c7-phqw and an OpenCode pull request. The record is unreviewed and its affected and patched fields read “Unknown”; the fixed version, 11.0.0, comes from the description and the release tag.

Analysis. The entry point is not the browser; it is the helper that launches the browser. An MCP client doing OAuth discovery fetches metadata from the server, takes authorization_endpoint from it, and calls open(url) so the user can sign in. The trust boundary crossed is between a remote server’s data and a local shell: the URL is treated as an address, and on Windows it becomes script text. Preconditions: Windows or WSL, a client built on an affected open, and a user who starts authentication against an attacker-controlled or compromised server. Blast radius is the user’s session on a developer machine, which usually means source code, cloud and package-registry tokens and the other MCP servers’ credentials. The Inspector item on 25 Oct (High 8.8, fixed in 2.12.0) and the OpenCode flaw referenced on 22 Oct are two instances; the CVE makes the shared cause searchable. It is the same class as CVE-2025-6514 in mcp-remote, where a server-supplied authorization URL also reached a shell, and it maps to OWASP LLM03 (supply chain) and MITRE ATLAS initial access through a compromised or malicious tool server. I could not read the vendor pages for OpenCode, so I cannot confirm from a primary source which of its builds are fixed.

Why it matters. MCP’s own authorization flow tells clients to send users to a URL chosen by the server. Any client built on that flow has to treat the URL as hostile input, and the common helper did not. Expect more records of this shape as downstream products publish their own advisories over the coming days.

Mitigation and detection. Inventory with npm ls open --all across your clients, wrappers and extensions, including vendored copies in desktop apps. Upgrade to open 11.0.0 or to a product build that bundles it. Where you cannot, validate that the authorization URL is https, has no characters outside a strict URL alphabet and, for a sensitive environment, only comes from a server on an allow-list. On Windows endpoints, alert on a PowerShell child of a Node-based developer tool whose command line contains -EncodedCommand.

Recommendation (opinion): act this week. Treat “client opens a URL from a server” as a code-execution boundary in your review checklist, and make developers on Windows connect to remote MCP servers only from a reviewed list until your tools are on a fixed open.

Sources: GHSA-jgwm-4pmq-r4w4 / CVE-2026-119025 · Earlier coverage: Inspector advisories

pdf-reader-mcp: a startup log line that says authentication is on

OfficialCVSS 7.5Late find · first published 25 Jun

What happened. GitHub marked CVE-2026-62264 (GHSA-q344-5v34-gm84) as reviewed on 29 Oct for @sylphx/pdf-reader-mcp 2.2.0 up to before 3.0.1. When started with MCP_TRANSPORT=http, the server read MCP_API_KEY and logged that authentication was enabled, but never validated the X-API-Key header, so the /mcp endpoint accepted unauthenticated requests. The default bind address was 0.0.0.0. The default stdio transport is not affected. It was found via the GitHub advisory index re-review, not a news source; the advisory credits a private reporter, novice-22.

Analysis. Entry point: the network port. Trust boundary: the process’s filesystem, reached by anyone who can connect. Root cause: configuration was parsed and reported but no code consumed it (CWE-306, CWE-287, CWE-200). Preconditions: the opt-in HTTP mode and network reachability. Blast radius: any PDF the process can open, plus limited SSRF through URL sources, which is a document-exfiltration primitive for anyone who finds the port. What makes it worth noting is the misleading log: an operator reading startup output concludes the control is active, and a scan of “is the key set” passes. The earlier cases this week and last, such as the Python SDK fixes that shipped with the audience check off by default, share the pattern that the control exists in the code and not in the behaviour.

Why it matters. Many MCP servers are packaged by small authors and started in HTTP mode to share them with a team or a remote agent; they rarely have tests that call the endpoint without credentials.

Mitigation and detection. Upgrade to 3.0.1, which enforces the key with a constant-time comparison, returns 401 and defaults to 127.0.0.1. Until then use stdio, bind to loopback, restrict file access with --allow-dir or MCP_PDF_ALLOWED_DIRS, or front it with an authenticating proxy. Test, don’t trust: one unauthenticated curl against each HTTP-mode MCP server in your estate should return 401.

Recommendation (opinion): verify, then standardise. Put a “request without credentials is refused” test in the acceptance checklist for every MCP server you deploy, and prefer a gateway that enforces authentication in front of servers rather than relying on each server to do it.

Sources: GHSA-q344-5v34-gm84 / CVE-2026-62264

Vulnerabilities in agent infrastructure

vLLM 0.32.0: three advisories that explain the new defaults

OfficialCVSS 8.1Update · 28 Oct

What happened. The 29 Oct signal described vLLM 0.31.0 and 0.32.0 adding request-input gates, source-tagged cache keys and signed shared-memory handles. The advisories behind those changes were indexed on 28 Oct. CVE-2026-115912 (High 7.5, CWE-502): with --mm-processor-cache-type shm, the worker trusts an address and monotonic id supplied in a request’s multimodal data as authority to read shared memory, and then calls pickle.loads on the bytes; the proof of concept used a harmless marker and made the engine’s health endpoint return 503. CVE-2026-115915 (High 8.1): ImageMediaIO hands image bytes to Pillow’s format autodetection with no allow-list, so a payload declared as PNG can be parsed as EPS, which Pillow passes to the host’s Ghostscript. CVE-2026-115918 (Moderate 6.5): the /v1/responses endpoint accepts request-level chat_template_kwargs and renders a request-supplied Jinja template without the --trust-request-chat-template gate the other routes enforce.

Analysis. All three are the same error: a caller-supplied value decides what code or resource the server touches (a memory address, a decoder, a template). The reporter for the first is credited as Patch the Planet, a Trail of Bits and OpenAI collaboration. The Ghostscript chain is an N-day rather than a new flaw: it needs a host Ghostscript build affected by CVE-2024-29510, which vLLM does not declare as a dependency, so whether you are exposed depends on your container image. The advisory reproduced loader-level execution with a benign marker on vLLM 0.30.0 but traced the HTTP request path in source only, which I note as untested end to end. The first requires credentials and the SHM cache option; the third is availability only. This is the identifier-as-authority pattern from the 29 Oct brief applied to an inference server, and it maps to OWASP LLM05 (improper output handling, as the decoder output is trusted) and ATLAS execution via an ML-serving component.

Why it matters. Inference servers are being exposed to more users and agents, and multimodal inputs widen what a request can make the server parse. A shared inference endpoint with per-team keys is a place where a low-privilege key should not equal code execution.

Mitigation and detection. Upgrade to 0.32.0. Pin Pillow to 12.3.0 or later. Remove Ghostscript from inference images or use a fixed build (10.03.1). Disable SHM multimodal caching if you cannot upgrade. Restrict /v1/responses and image-capable routes to the callers that need them. Watch for a Ghostscript (gs) process spawned by the vLLM server, and for EngineCore health flipping to 503 after a request.

Recommendation (opinion): upgrade this week if you serve multimodal models to more than one team, and add “no extra interpreters in the image” to your inference container baseline.

Sources: GHSA-6757-hggm-hp2w · GHSA-h3rc-j82p-2c3h · GHSA-x567-49g5-p4cf · 29 Oct signal

GitPython: a submodule name that reads your CI environment

OfficialCVSS 6.5Late find · first published 30 Sep

What happened. GHSA-fx3j-rwgx-fr94, published 30 Sep and updated 27 Oct, covers GitPython 3.1.62 and earlier. Repo._clone() passes the separate_git_dir value through a URL-polishing helper without turning off environment-variable expansion, and Submodule._clone_repo() builds that value from the raw .gitmodules submodule name, whose validation rejects absolute paths and .. but not $. A submodule named after an environment variable therefore has it expanded. It is fixed in 3.2.0 (the project is now at 3.2.1).

Analysis. The attacker controls only a repository; the victim must clone it and run submodule_update(init=True, recursive=True), a routine step for bots and coding agents. The secret ends up as a directory name under .git/modules/ and, with debug logging on, in the logged command line, so the exposure is mostly through logs and persisted workspaces. Severity is moderate for that reason. It matters beyond its score because GitPython is the library under the MCP git server whose confinement bypass was fixed on 28 Oct, so the same dependency now has several fixes that an agent image built before September will lack.

Mitigation and detection. Upgrade to 3.2.0 or later, avoid recursive submodule initialisation on untrusted repositories, and keep CI secrets out of the environment of processes that clone third-party code. Search build logs and workspaces for unexpected directory names under .git/modules.

Sources: GHSA-fx3j-rwgx-fr94 · GitPython releases

Small items

• Royal MCP WordPress plugin (CVE-2026-111960, Moderate 4.3, unreviewed): the search tool lacks object-level and post-type checks in versions before 1.5.10 by description, so a subscriber-level account can read non-public entries. A sibling record, CVE-2026-111961, is Low. The MCP tool does not apply the CMS’s own permission model.
• Google Cloud MCP Toolbox for Databases (CVE-2026-93328, Critical 9.3, covered 28 Oct): I looked for the fix. The advisory lists no patched version and gives 1.2.0 through 1.4.0 as affected; the release page shows v1.15.0 on 23 Oct but no note naming the path-traversal fix. Treat the fixed version as unconfirmed and upgrade to the latest.

Incidents and threat intelligence

Nothing new in the window passed the inclusion test. I found no new confirmed incident involving agents between 08:00 on 29 Oct and 08:00 on 30 Oct. The OpenCode console breach (disclosed 17 to 19 Oct) was covered earlier and I have no new development to add.

Research and policy

Nothing new in the window passed the inclusion test. I found no new OWASP, NIST, CISA, ENISA or INCIBE agent-security publication dated 29 or 30 Oct, and arXiv does not resolve from this environment, so I cannot rule out research published in the window. I report none.